End-to-End vs. Local VLAN Models

I often get questions related to the real differences between what Cisco defines as an end-to-end VLAN model and a local VLAN model. I think part of the confusion is that very few organizations actually use a large-scale end-to-end VLAN model these days, so few can relate to how it might work. I wanted to take a minute to clear the two campus VLAN architecture types up for everyone’s benefit.

End-to-End VLANs

end-to-end vlans diagram

In this model, VLANs are trunked across the entire organization, campus, or building – regardless of where end hosts are physically located. The VLANs are strictly based on function with little or no regard for where they may be at any given time. That means all switches contain all VLANs. Obviously this becomes difficult to maintain at scale, which is why VTP is often used in conjunction with the end-to-end VLAN model. Simply add or modify a VLAN on an VTP server switch and the changes are automatically propagated. Of course VTP adds more risk to the mix, but that’s another topic.


Perhaps the biggest benefit to an end-to-end architecture is that any user can get access to their resources from any switch. If a VMPS server is deployed, a user can plug into any switch port and will automatically be assigned to their correct “home” VLAN. Sounds good right?


There are some serious drawbacks though. First, end-to-end VLANs are very difficult to maintain across large networks. If you are not running VTP server or client mode on all of your switches, then every switch must be configured with the correct VLAN assignments manually. And what happens when it comes time to troubleshoot an issue when you have hundreds of switches and to comb through? Managing this type of environment is difficult, but just as concerning is the performance trade-off. If every VLAN is stretched accross every switch, that means they must also cross the distribution and core of your network. All of the broadcast traffic on all VLANs then must also traverse the core, which can lead to serious performance problems.

The main reason I see end-to-end VLANs still used in some organizations is for application requirements. Some apps require all hosts to be on the same segment – regardless of physical location. If this is the case, some VLANs may have to be stretched in an end-to-end fashion.

Local VLANs

local vlans diagram

The local VLAN model is more based around geographical proximity than it is around universal accessibility. In this approach, VLANs are local to a block of switches and never extend all of the way to the core. Instead, they rely on a hierarchical switch structure to terminate the layer two boundaries. For example, you may have VLAN 100 used for “first floor workstation connectivity”. There may be more than one switch that supports the first floor, but they will all be somewhat close. More importantly, all of them will connect to the same pair of distribution layer switches which will act as the default gateway for the local VLAN segments. From there packets are routed to the core using layer three protocols, not layer two VLANs.

Switching of local VLANs at the access layer. Routing at the distribution and core.


A local VLAN configuration means simplified VLAN troubleshooting and fewer spanning tree design considerations. Performance is also improved with SVIs on the distribution switches – creating smaller broadcast domains.


There are few drawbacks to the local VLAN model. If you are used to VTP automating and propagating your VLAN changes, then it might become a more manual process. That said, the overall management overhead required is still reduced when compared to a large-scale end-to-end VLAN deployment.

Hopefully this is helpful for those of you just getting in to VLAN design and architecture. Many people would argue that these labels don’t mean much anymore, but if you’re studying for the CCNP SWITCH exam, you will need to understand the distinctions and features of both models.

Stay focused,


Author Aaron

Aaron knows networks. He's been involved in building and supporting world-class data networks for the past 10 years - from international cloud service providers to Fortune 50 data centers. Aaron consults independently and is focused on building the best training platform available.

More posts by Aaron

Join the discussion 4 Comments

  • Ricardo E. Quezada Sánchez says:

    Excellent explanation Aron, I’m from Peru and I have some questions I hope you can aclararmelas as best practices.

    01) In the model of vlan local as administer the vlan management of the switches, ie for example: I have two buildings “A” and “B” in different geographic locations both with many switch’s that are configured in the way Local vlan
    I want to be in the building “A” to manage the premises switch B
    Is this would be carried out through some routing protocol?
    Does the management VLAN would have to transfer the distribution layer?

    02) Having the same topology, building “A” and “B” in different geographic locations, the local vlan mode and in both places I have multiple SSID wireless equipment with which they are planning to implement a captive portal which will be installed physically in the building “A”.
    Is the VLAN wireless equipment must pass through the distribution layer?

    Thanks for your support in advance.

    • Aaron says:

      Hi Ricardo – great questions!

      1. You are correct in that in a local VLAN model, the VLANs would be local to each building and layer 3 links would be used for site-to-site connectivity. You could either use static routes or a dynamic routing protocol to share route information between buildings over the L3 connections. In this case, each building would have its own management VLAN, so no single VLAN would exist locally in both locations.

      2. You can tackle this a few different ways. If you need the access point’s on the same segment as your wireless controller, then you will have to span a L2 connection across buildings – treating each building as one large location. Alternatvely, most modern wireless controllers do support a remote (L3) option, like H-REAP or Cisco’s new re-branded FlexConnect.

      Hope that helps.

      • Ricardo E. Quezada Sánchez says:

        Hi Aron, Thanks for clearing the doubts aron, always good to see these the best alternative solution against some probremas, apologizing clarify your kindness in I forgot my duas consult you some extra stuff and I think very important in the networks now.

        Having the same network topology of buildings “A” – “B” – “C” where the data center is located in Building “A” generated the following questions:

        1) For local VLANs that are in the building “B” and “C” enter internet this would have to relizar using the gateway of last resort, but the gateway to know the entire topology intervlans would facilitate communication.

        This is true?

        If correct, to block communication between vlans that be would conduct with acl within the distribution layer?

        2) For Voice VLAN which would be the best solution:
        The voice VLAN must transpasar the link layer to the distribution in order to communicate with the VoIP server. ?
        The Voice VLan should be under a routing protocol for all local vlans all buildings?

        I hope you can clarify these doubts.

        Thanks in advance.
        Success in your website.

  • Ajhar says:

    Expert explanation to get clear the different between local vlan and end to end vlan

    Well done!!!

Leave a Reply